auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectAAFLur.java

   1 /**
   2  * ============LICENSE_START====================================================
   3  * org.onap.aaf
   4  * ===========================================================================
   5  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
   6  * ===========================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  * ============LICENSE_END====================================================
  19  *
  20  */
  21
  22 package org.onap.aaf.auth.direct;
  23
  24 import static org.onap.aaf.auth.layer.Result.OK;
  25
  26 import java.security.Principal;
  27 import java.util.List;
  28
  29 import org.onap.aaf.auth.dao.cass.NsSplit;
  30 import org.onap.aaf.auth.dao.cass.PermDAO;
  31 import org.onap.aaf.auth.dao.cass.Status;
  32 import org.onap.aaf.auth.dao.cass.PermDAO.Data;
  33 import org.onap.aaf.auth.dao.hl.Question;
  34 import org.onap.aaf.auth.env.AuthzEnv;
  35 import org.onap.aaf.auth.env.AuthzTrans;
  36 import org.onap.aaf.auth.env.NullTrans;
  37 import org.onap.aaf.auth.layer.Result;
  38 import org.onap.aaf.cadi.Lur;
  39 import org.onap.aaf.cadi.Permission;
  40 import org.onap.aaf.cadi.Access.Level;
  41 import org.onap.aaf.cadi.lur.LocalPermission;
  42 import org.onap.aaf.misc.env.util.Split;
  43
  44 public class DirectAAFLur implements Lur {
  45         private final AuthzEnv env;
  46         private final Question question;
  47
  48         public DirectAAFLur(AuthzEnv env, Question question/*, TokenMgr tm*/) {
  49                 this.env = env;
  50                 this.question = question;
  51 //              oauth = new OAuth2Lur(null);
  52         }
  53
  54         @Override
  55         public boolean fish(Principal bait, Permission pond) {
  56                 return fish(env.newTransNoAvg(),bait,pond);
  57         }
  58
  59         public boolean fish(AuthzTrans trans, Principal bait, Permission pond) {
  60                 Result<List<Data>> pdr = question.getPermsByUser(trans, bait.getName(),false);
  61                 switch(pdr.status) {
  62                         case OK:
  63                                 for(PermDAO.Data d : pdr.value) {
  64                                         if(new PermPermission(d).match(pond)) {
  65                                                 return true;
  66                                         }
  67                                 }
  68                                 break;
  69                         case Status.ERR_UserRoleNotFound:
  70                         case Status.ERR_BadData:
  71                                 return false;
  72                         default:
  73                                 trans.error().log("Can't access Cassandra to fulfill Permission Query: ",pdr.status,"-",pdr.details);
  74                 }
  75                 return false;
  76         }
  77
  78         @Override
  79         public void fishAll(Principal bait, List<Permission> permissions) {
  80                 Result<List<Data>> pdr = question.getPermsByUser(env.newTrans(), bait.getName(),false);
  81                 switch(pdr.status) {
  82                         case OK:
  83                                 for(PermDAO.Data d : pdr.value) {
  84                                         permissions.add(new PermPermission(d));
  85                                 }
  86                                 break;
  87                         default:
  88                                 env.error().log("Can't access Cassandra to fulfill Permission Query: ",pdr.status,"-", pdr.details);
  89                 }
  90         }
  91
  92         @Override
  93         public void destroy() {
  94         }
  95
  96         @Override
  97         public boolean handlesExclusively(Permission pond) {
  98                 return false;
  99         }
 100
 101         /**
 102          * Small Class implementing CADI's Permission with Cassandra Data
 103          * @author Jonathan
 104          *
 105          */
 106         public static class PermPermission implements Permission {
 107                 private PermDAO.Data data;
 108
 109                 public PermPermission(PermDAO.Data d) {
 110                         data = d;
 111                 }
 112
 113                 public PermPermission(AuthzTrans trans, Question q, String p) {
 114                         data = PermDAO.Data.create(trans, q, p);
 115                 }
 116
 117                 public PermPermission(String ns, String type, String instance, String action) {
 118                         data = new PermDAO.Data();
 119                         data.ns = ns;
 120                         data.type = type;
 121                         data.instance = instance;
 122                         data.action = action;
 123                 }
 124
 125                 @Override
 126                 public String getKey() {
 127                         return data.type;
 128                 }
 129
 130                 @Override
 131                 public boolean match(Permission p) {
 132                         if(p==null) {
 133                                 return false;
 134                         }
 135                         PermDAO.Data pd;
 136                         if(p instanceof DirectAAFLur.PermPermission) {
 137                                 pd = ((DirectAAFLur.PermPermission)p).data;
 138                                 if(data.ns.equals(pd.ns))
 139                                         if(data.type.equals(pd.type))
 140                                                 if(data.instance!=null && (data.instance.equals(pd.instance) || "*".equals(data.instance)))
 141                                                         if(data.action!=null && (data.action.equals(pd.action) || "*".equals(data.action)))
 142                                                                 return true;
 143                         } else{
 144                                 String[] lp = p.getKey().split("\\|");
 145                                 if(lp.length<3)return false;
 146                                 if(data.fullType().equals(lp[0]))
 147                                         if(data.instance!=null && (data.instance.equals(lp[1]) || "*".equals(data.instance)))
 148                                                 if(data.action!=null && (data.action.equals(lp[2]) || "*".equals(data.action)))
 149                                                         return true;
 150                         }
 151                         return false;
 152                 }
 153
 154                 @Override
 155                 public String permType() {
 156                         return "AAFLUR";
 157                 }
 158
 159         }
 160
 161         public String toString() {
 162                 return "DirectAAFLur is enabled";
 163
 164         }
 165
 166         /* (non-Javadoc)
 167          * @see org.onap.aaf.cadi.Lur#handles(java.security.Principal)
 168          */
 169         @Override
 170         public boolean handles(Principal principal) {
 171                 return true;
 172         }
 173
 174         @Override
 175         public Permission createPerm(String p) {
 176                 String[] params = Split.split('|', p);
 177                 if(params.length==3) {
 178                         Result<NsSplit> nss = question.deriveNsSplit(NullTrans.singleton(), params[0]);
 179                         if(nss.isOK()) {
 180                                 return new PermPermission(nss.value.ns,nss.value.name,params[1],params[2]);
 181                         }
 182                 }
 183                 return new LocalPermission(p);
 184         }
 185
 186         @Override
 187         public void clear(Principal p, StringBuilder sb) {
 188                 AuthzTrans trans = env.newTrans();
 189                 question.clearCache(trans,"all");
 190                 env.log(Level.AUDIT, p.getName(), "has cleared Cache for",getClass().getSimpleName());
 191                 trans.auditTrail(0, sb);
 192         }
 193 }